Dependabot


**Update (2021, pt.2): Do you want to know how to run Dependabot locally?**

I wrote a follow-up to this article based on a question I've been getting fairly regularly: How do you run dependabot locally? You asked, I answered - check it out here: How to [run dependabot locally](https://mikebifulco.com/posts/run-dependabot-locally) on your projects

**Update (2021)** Dependabot has been Acquired by GitHub, and many of the links from this post stopped working once they took down the original site (dependabot dot com). I've updated URLs here to point to more relevant links within GitHub's docs.

[Dependabot](https://github.com/dependabot) is an automation service that will automatically create PRs to keep your projects' dependencies up to date, and it is really powerful.

<Image
  publicId="posts/i-have-to-tell-you-about-dependabot/dependabot-settings"
  alt="Screenshot of the settings interface for a project on the former Dependabot.com"
  caption="Setup for Dependabot is flexible, quick, and straightforward."
/>

In just a few, sweet, wonderful minutes, you can install and configure it to automatically keep an eye on your project dependencies, and set a daily or weekly schedule to submit updates and changes. Automation at its finest - dependabot is like having a super mindful teammate who keeps an eye on npm (or pip or rubygems or one of [many other languages](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates#supported-repositories-and-ecosystems)) - you'll automatically get great, well-formed PRs for each dependency version bump, which you can test locally, or have sent up to your CI toolchain of choice.

After you run through the setup process, dependabot will monitor your repo and submit PRs to update individual dependencies on a daily or weekly rhythm (your choice!). If the PR contains an important security update, it will be assigned a label of Security, too.

<Image
  publicId="posts/i-have-to-tell-you-about-dependabot/dependabot-pr"
  alt="An example PR from dependabot"
  caption="Automatically created PRs are simple and to the point."
/>

Honestly, for me, it's like adding a member to my team. I love automation, and I love making my life simpler. Until now, for all of my projects, myself or another teammate would regularly run through all the dependencies in a given repo, and manually update them one at a time, testing and pushing them to GitHub to be run through CI and then eventually merged by the team. The honest truth is that this process can take quite a while, and can be forgotten, and isn't mindful of important security updates at all. That's all over now.

<Image
  publicId="posts/i-have-to-tell-you-about-dependabot/merge"
  alt="An example PR from dependabot"
  caption="Dependabot will merge this PR once CI is done, thanks to the @dependabot merge command"
/>

## What else?

There are a _ton_ of other features available to you the moment you install dependabot. It responds to a wide variety of commands by way of GitHub comment. In the screenshot above, I've approved a PR and asked dependabot to merge it as soon as CI has passed. Now I don't have to babysit the repo in order to merge updates! Sweet!

If your repo contains multiple languages, Dependabot can handle that. If you've got a complex monorepo with multiple files representing your dependencies (for example, a node project set up with Lerna), dependabot can monitor each dependency file individually, with different rules for each.

<Image
  publicId="posts/i-have-to-tell-you-about-dependabot/github"
  alt="Dependabot's announcement that they were acquired by GitHub"
  caption="Dependabot was acquired by GitHub"
/>

This was the final kicker for me. Dependabot was [just acquired by GitHub](https://github.blog/2019-07-25-one-million-dependabot-pull-requests-merged/), and is now available completely free for use. That's incredible! There's no reason for you not to give it a shot. Go check it out now, post haste!

Go install [Dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)!

## For more reading

- Check out my follow-up post: How to [run dependabot locally](https://mikebifulco.com/posts/run-dependabot-locally)

_Note: the cover photo for this article comes from one of my favorite photographers, [Alex Knight](https://twitter.com/agkdesign), and was made available un [Unsplash](https://unsplash.com/search/photos/robot?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText). Thank you Alex for your work!_


I have to tell you about Dependabot 🤖


Dependabot is a fantastically useful tool provided by GitHub to monitor security vulnerabilities in your project's dependencies.

It can be used to automatically create Issues and Pull requests on your projects for security fixes and library updates, which is a great way to keep your project's dependencies up to date.

<Aside type="info">

Note: this is a follow on to my post about [why GitHub's Dependabot is so amazing](https://mikebifulco.com/posts/i-have-to-tell-you-about-dependabot). If you're not yet using Dependabot in your projects, you may want to start there!

</Aside>

Since I published my initial article, one questions I get asked fairly regularly by readers and folks on twitter is: what do I have to do to run Dependabot locally? To be honest, this is not something I had ever considered - and for a while I didn't think it was something you could do. It turns out I was wrong! Running dependabot locally will let you create a custom security management system to automate Pull Requests and Issues for your project's dependencies.

## How to run dependabot locally on your projects

**If you're working on a software development project that has needs which aren't met by Dependabot's built-in automation, you'll be happy to hear that you can customize your dependency automation with [Dependabot Core](https://github.com/dependabot/dependabot-core) and [Dependabot Script](https://github.com/dependabot/dependabot-script). They're designed to be used together to allow you to set up your own Dependabot automations, with options for interactive and non-interactive workflows.**

- [Dependabot Core](https://github.com/dependabot/dependabot-core) contains the main logic that is used to create PRs and Issues with Dependabot. This is where the bulk of the brains for Dependabot's automation is contained, and it's what you'll be using to create your own automation. You will also find Dependabot's public issue tracker within this repo, so if you find yourself running into challenges, you can open an issue there, or search through existing threads to see if anyone else has already run into the same problem as you.
- [Dependabot Script](https://github.com/dependabot/dependabot-script) is a library which contains _sample_ scripts that use Dependabot core. It's a helpful illustration of how to use Dependabot's core to create dependency update automations which suit your needs.

## Setup

1. To get started, clone the [dependabot-script](https://github.com/dependabot/dependabot-script) repo, with `git clone https://github.com/dependabot/dependabot-script.git`
1. Install the repo's dependencies with `rbenv install` (which sets up the correct version of Ruby), followed by `bundle install` (which installs the rest of the dependencies)

## Configure Dependabot Helpers

From here, steps will vary depending on the particulars of your project. There are _helpers_ provided for dependabot-core for Terraform, Python, Go Dep, Go Modules, Elixir, PHP, and JavaScript. The install steps for each of these vary slightly - you should check the [Readme for dependabot-script](https://github.com/dependabot/dependabot-script#native-helpers) for details.

## Familiarize yourself with the default script

Once you're set up, you'll want to look at [update-script.rb](https://github.com/dependabot/dependabot-script/blob/main/update-script.rb) - this contains a fairly generic setup to test for dependencies with dependabot-core. You will need to modify this file to suit your needs.

Look for the [following lines](https://github.com/dependabot/dependabot-script/blob/main/update-script.rb#L17-L23) to customize and set up your credentials:

```rb
# GitHub credentials with write permission to the repo you want to update
# (so that you can create a new branch, commit and pull request).
# If using a private registry it's also possible to add details of that here.
credentials =
  [{
    "type" => "git_source",
    "host" => "github.com",
    "username" => "x-access-token",
    "password" => "a-github-access-token"
  }]
```

Next, specify the name of your repo, the language you want Dependabot to check for updated libraries and security vulnerabilities, and the package manager you use:

```rb
# Name of the dependency you'd like to update. (Alternatively, you could easily
# modify this script to loop through all the dependencies returned by
# `parser.parse`.)
dependency_name = "rails"

# Name of the package manager you'd like to do the update for. Options are:
# - bundler
# - pip (includes pipenv)
# - npm_and_yarn
# - maven
# - gradle
# - cargo
# - hex
# - composer
# - nuget
# - dep
# - go_modules
# - elm
# - submodules
# - docker
# - terraform
package_manager = "npm_and_yarn"

```

## Run the script

You've done all the work needed to run the script, and generate a round of automated updates via PR. Run dependabot-core with your newly customized script with:

```bash
bundle exec irb
```

Follow any prompts on the CLI, and you've done it! Note that there are a couple other ways you might run Dependabot locally, but this is the easiest way to get started. You can check out the other options in the [README.md](https://github.com/dependabot/dependabot-script#running-dependabot) for more details.

## Now customize it!

Once you've got the base script running, check out the [docs for dependabot-core](https://github.com/dependabot/dependabot-core#dependabot-package-manager) to see how to customize it further. For example, you may want to use `FileParser` to list all dependencies for your projects, to keep an eye on changes to OSS Licenses. You might use `MetadataFinder` to look up which of your dependencies are looking for sponsors, so that you can help fund the tools that keep your software running.

## What will you use Dependabot for?

From here, the sky's the limit! If you're someone who is customizing dependabot for a specific need, I'd love to hear what you're doing. Feel free to drop me a line on [twitter @irreverentmike](https://twitter.com/irreverentmike) - I'd love to hear about your project!

## More reading

- GitHub provides a ton of other features and functionality to manage security in your software. You can read more at [github.com/features/security](https://github.com/features/security)
- As mentioned above, this is a follow-up to [my initial article, a primer on Dependabot](https://mikebifulco.com/posts/i-have-to-tell-you-about-dependabot). Feel free to give that a look!


How to run dependabot locally on your projects

Familiarize yourself with the default script

💌 Tiny Improvements Newsletter